Not knowing anything about VNET, I thought I would look up some info via GROK:-
FreeBSD VNET refers to the
Virtual Network Stack (also called VIMAGE).
It gives each jail its
own complete, isolated network stack — its own interfaces, routing table, ARP cache, firewall (PF/IPFW), and sockets. The jail behaves almost like a separate machine.
VNET vs normal (shared) jail networking
| Feature | Shared network stack | VNET |
|---|
| Network isolation | Low | High |
| Own interfaces | No (uses host IPs) | Yes |
| Own routing table | No | Yes |
| Own firewall | No (shares host PF) | Yes |
| Complexity | Simple | Higher |
| Performance overhead | None | Small |
| Best for | Simple services | Full isolation, VPN, routers, etc. |
Basic requirements
VNET is enabled by default in modern FreeBSD (13+ / 14 / 15):
Bash
Code:
[COLOR=rgb(126, 178, 51)]sysctl[/COLOR][COLOR=rgb(164, 65, 133)] kern.features.vimage[/COLOR][/COLOR]
[COLOR=rgb(0, 35, 57)][I][COLOR=rgb(53, 123, 66)]# should return 1[/COLOR][/I]
Load the needed modules:
Bash
[COLOR=rgb(126, 178, 51)]sysrc[/COLOR][COLOR=rgb(164, 65, 133)] kld_list+="if_bridge if_epair"[/COLOR]
How VNET jails are usually connected
Create a bridge on the host (connected to the physical/VPS interface, often vtnet0).
Create an epair (virtual Ethernet cable) for each jail.
One end of the epair stays on the host (added to the bridge).
The other end is moved into the jail (vnet.interface).
Example simplified jail.conf snippet:
confweb {
path = "/jails/web";
host.hostname = "web.example.com";
vnet;
vnet.interface = "epair0b";
exec.prestart = "ifconfig epair0 create";
exec.prestart += "ifconfig bridge0 addm epair0a";
exec.prestart += "ifconfig epair0a up";
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.poststop = "ifconfig epair0a destroy";
mount.devfs;
allow.raw_sockets;
}
Code:
[COLOR=rgb(126, 178, 51)]kldload[/COLOR][COLOR=rgb(164, 65, 133)] if_bridge if_epair[/COLOR]
How VNET jails are usually connected
- Create a bridge on the host (connected to the physical/VPS interface, often vtnet0).
- Create an epair (virtual Ethernet cable) for each jail.
- One end of the epair stays on the host (added to the bridge).
- The other end is moved into the jail (vnet.interface).
Example simplified jail.conf snippet:
conf
web {
path = "/jails/web";
host.hostname = "web.example.com";
vnet;
vnet.interface = "epair0b";
exec.prestart = "ifconfig epair0 create";
exec.prestart += "ifconfig bridge0 addm epair0a";
exec.prestart += "ifconfig epair0a up";
exec.start = "/bin/sh /etc/rc";
exec.stop = "/bin/sh /etc/rc.shutdown";
exec.poststop = "ifconfig epair0a destroy";
mount.devfs;
allow.raw_sockets;
}
Inside the jail you then configure the interface normally (ifconfig_epair0b=... in the jail’s /etc/rc.conf).
Note about
On most FreeBSD VPS (KVM/QEMU), the physical network interface is called
vtnet0 (VirtIO network driver).This is
different from VNET (the jail feature).
Would you like a complete working example for:
- Simple VNET jail with bridge + NAT, or
- VNET jail bridged directly to the public interface (vtnet0)?
Anyone care to tell me which of those I want since this is all gobbledigook to me?
